Home / ISO 27001

ISO 27001 Information Security

Structured protection of critical data — and the client trust it earns you. Risk-led, proportionate, and built on controls you will actually operate.

Based in Greater Manchester, supporting businesses across the UK.

Request a Free Consultation Our Process
ISO 27001 Information Security
STANDARDISO 27001:2022
DISCIPLINEInformation Security
SUPPORTGap analysis to certification

What ISO 27001 is

ISO 27001 is the international standard for information security management systems (ISMS). It sets out how to identify information security risks and apply proportionate controls to manage them — covering people, process and technology, not just IT.

The 2022 revision restructured the Annex A controls into four themes: organisational, people, physical and technological, with several new controls covering areas such as threat intelligence, cloud services and data leakage prevention.

Why organisations certify

  • Frequently demanded by enterprise clients and in procurement due diligence
  • Supports UK GDPR and data protection obligations
  • Reduces the likelihood and impact of breaches and downtime
  • Replaces repeated ad-hoc security questionnaires with one recognised certificate

How we support you

Scope and context

We define a defensible ISMS scope. Getting scope right is the single biggest driver of cost and effort — too wide and the project balloons, too narrow and clients will not accept it.

Risk assessment and treatment

We run a structured information security risk assessment, agree risk criteria and appetite, and produce a risk treatment plan with owners and timescales.

Statement of Applicability and controls

We produce the Statement of Applicability against the Annex A controls, documenting which apply, which do not, and why — then help you implement policies and controls proportionate to your risk.

Internal audit and certification

We support internal audit of the ISMS and management review, and prepare you for Stage 1 and Stage 2 certification assessment.

What you get

  • A structured, documented risk assessment process
  • Protection of critical data proportionate to actual risk
  • Customer and stakeholder trust, evidenced by certification
  • Faster, cleaner responses to client security due diligence
FAQ

Frequently asked questions

How long does ISO 27001 certification take?

For a small or medium organisation, three to six months from start to certification is a common range, depending on how much is already documented and how quickly the certification body can schedule audits. We confirm a timeline after the gap analysis.

How much does ISO 27001 cost?

There are two parts: consultancy support, which depends on your size, scope and starting position, and the certification body’s audit fees, which you pay to them directly. We give a clear estimate after the gap analysis.

Do I need a consultant, or can I do it myself?

You can do it yourself, and many organisations do. A consultant shortens the route, helps you avoid over-documenting and prepares you for the audit.

Can ISO 27001 be combined with other standards?

Yes. ISO 9001, ISO 14001, ISO 45001 and ISO 27001 share a common high-level structure, so they can be run as one integrated management system.

Is ISO 27001 a legal requirement?

No. It is not a legal requirement, but it supports your UK GDPR and data protection obligations and is often required by clients during procurement.

Let’s talk about your project.

Tell us where you are now — we’ll come back with a first assessment and next steps.

Request a Free Consultation